TL;DR — 别开 public issue。用 Security Advisory（推荐） 或邮件 dwgx1337@gmail.com，标题前缀 [WindsurfAPI Security]。72 小时内回复。

Do not open a public issue. Use a Security Advisory (preferred) or the email above.

flowchart TD
    F["发现问题 / Found something"] --> Q{"能否被外部触发?<br/>externally triggerable?"}
    Q -->|"否 / no"| SCAN["扫描器报告但无实证影响<br/>→ 普通 issue<br/>scanner output, no demonstrated impact"]
    Q -->|"是 / yes"| W{"影响什么?<br/>what does it reach?"}
    W -->|"认证 / 凭证 / RCE / SSRF"| ADV["Security Advisory<br/>私下上报 · private"]
    W -->|"注入 XSS / command / prompt"| ADV
    W -->|"Dashboard API"| ADV
    W -->|"上游限流绕过<br/>upstream rate limit"| OUT["范围外 —— 属账号管理<br/>out of scope"]

    classDef danger fill:#d1242f22,stroke:#d1242f,stroke-width:2px
    classDef ok fill:#1a7f3722,stroke:#1a7f37
    class ADV danger
    class SCAN,OUT ok

If you discover a security vulnerability in WindsurfAPI, please do not open a public GitHub issue.

Public issues are indexed by search engines and watched by forks — disclosing there exposes every deployed instance before a fix lands.

Instead, report privately via one of:

• GitHub Security Advisories: https://github.com/dwgx/WindsurfAPI/security/advisories/new (preferred — encrypted, tracks the fix)
• Email: dwgx1337@gmail.com with subject prefix [WindsurfAPI Security]

Please include:

• A description of the vulnerability and its impact
• Steps to reproduce (PoC appreciated)
• Affected version / commit SHA (check /health endpoint)
• Your contact for follow-up

You can expect a first response within 72 hours. Valid reports will be credited in the release notes (unless you prefer anonymity).

• Authentication bypass (dashboard, account pool)
• Account/token/credential leakage
• Remote code execution, SSRF, path traversal
• Injection attacks (XSS, command, prompt)
• Dashboard API vulnerabilities

• Rate-limit bypass on upstream Windsurf (that's an account-management concern, not a vuln in this proxy)
• Issues requiring physical access to the host
• Findings from automated scanners without demonstrated impact

发现安全漏洞请不要开 public issue。public issue 会被搜索引擎索引、被所有 fork 关注 —— 漏洞一旦公开，所有已部署的实例在补丁落地前都会暴露。

请用下面任一方式私下报告：

• GitHub Security Advisories（推荐，加密、跟进修复）：https://github.com/dwgx/WindsurfAPI/security/advisories/new
• 邮件：dwgx1337@gmail.com，标题前缀 [WindsurfAPI Security]

请附上：

• 漏洞描述 + 影响范围
• 复现步骤（有 PoC 最好）
• 受影响的版本 / commit SHA（看 /health 端点）
• 方便联系的方式

一般 72 小时内会首次回复。有效报告会在 release notes 里致谢（除非你要求匿名）。